Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related) (ISSUE No. 16)

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 26 Sep 2002 12:20:52 -0500

please see my comments inline.

Regards;
Ahmad Muhanna

Non-editorial comments associated with RFC3012bis:

Please post your comments with the appropriate issue number in the subject
line (instead of simply replying to this email).

-Chairs.

16.    -  Foreign agent recommended to include a Challenge in every
       Registration Reply, so that mobile node can re-register without
       waiting for an Advertisement.
       With the side effect of opening up a security hole - bogus
       registration replies must be accepted by the MN.

I do not think the issue here is to include a new challenge in a
Registration Reply 
with error code from the FA or not. The issue is the security hole which is
admitted by this RFC.

It is the choice of those who choose to implement this RFC, either:
1. To secure the link between the MN and the FA, e.g. 3GPP2, or
2. Have a preconfigured SA between the MN and the FA, it sounds very ODD, 
   BUT that was the assumption of RFC 2002, or
3. To wait until a way to dynamically establish a Security Association 
   between the MN and any visited FA emerged. "Dynamic Key Distribution"

Therefore, keeping this as part of the standard is a good thing for the
future.

Regards,
Ahmad